A new wave of crypto thefts is hitting macOS users as cybercriminals deploy a fake version of the Ledger Live app to harvest seed phrases and drain crypto wallets. The scheme was recently exposed by blockchain security firm Moonlock, which warned users of the growing sophistication of these attacks.
How the Attack Works
The malicious app mimics the official Ledger Live interface but is embedded with spyware that activates once users launch it. Victims are prompted to input their 24-word recovery phrase — the key to accessing their crypto assets — through a fake pop-up window that looks convincingly legitimate. Once entered, attackers instantly gain control of the user’s wallet and initiate fund withdrawals.
Unlike traditional phishing attempts that rely on browser-based tricks, this campaign targets macOS users directly by installing a cloned application. Early reports suggest the attackers may have originally used the malware to scrape passwords, notes, and wallet metadata before upgrading to full seed phrase theft.
Why This Matters for Crypto Security
Ledger Live is the official app used to manage hardware wallets from Ledger, a widely trusted name in crypto custody. By compromising the perceived trust in such applications, attackers not only steal funds but also erode confidence in the security infrastructure of the entire blockchain ecosystem.
Moonlock recommends users:
-
Only download Ledger Live from the official Ledger website
-
Never input their recovery phrase into any pop-up or app unless setting up a new Ledger device
-
Use anti-malware software that can detect and block fake applications on macOS
The Bigger Picture
This incident underscores the growing professionalism of Web3-focused cybercriminals. As crypto adoption rises, so does the incentive for attackers to craft highly convincing traps. The best defense? Always verify, never trust unsolicited prompts — and remember: your seed phrase is your wallet.
